1. Field of the Invention
This invention relates to improvements in an automatic train control apparatus (which will be abbreviated hereinafter as an ATC apparatus).
An ATC apparatus functions to control the running speed of a railway train to within a predetermined speed limit which is variable depending on the condition of the scheduled run of the train and also on the condition of the tracks. From its nature, the ATC apparatus is required to be highly fail-safe.
2. Description of the Prior Art
A prior art ATC apparatus is generally composed of a signal receiving section which receives a frequency-modulated ATC signal transmitted from a transmitter disposed along the track and identified the train speed limit indicated by the ATC signal, and a speed correlating section for comparing the above speed limit with the actual train speed detected by a tachogenerator and for generating an ATC brake instruction signal when the result of that comparison proves that the detected train speed exceeds the predetermined speed limit. The signal receiving section of the ATC apparatus must be fully fail-safe so that it can satisfactorily demodulate the received frequency-modulated ATC signal to remove the carrier frequency and then accurately identify the predetermined speed limit by a frequency discriminating function. In order that this frequency discriminating function may not become abnormal, three signal receiving sections are generally provided to receive the frequency-modulated ATC signal, and the frequency of the demodulated ATC signal is determined by taking the majority of the signal receiving section outputs, that is, according to the rule of two-out-of-three. The result of frequency discrimination is such that one of the signal receiving section outputs is decided to be indicative of the speed limit under the condition that all of the signal receiving section outputs lower than that have already appeared. For example, the speed limit is decided to be 45 km/hr when signal receiving section output indicative of 30 km/hr has already appeared. The speed limit is decided to be 60 km/hr only when the signal receiving section outputs indicative of 30 km/hr and 45 km/hr have already appeared. Further, the speed limit shifts necessarily toward a lower speed in the event of failure of any one of the analog circuit components constituting the signal receiving section, so as to ensure the fail-safe performance of the signal receiving section.
Also, to ensure the fail-safe performance of the speed correlating section of the ATC apparatus, the speed correlating section has been so constructed that not only is a failure detecting function additionally provided, but also the failure-free operability of this failure detecting function can be checked.
The high degree of fail-safe performance of the ATC apparatus has thus been realized heretofore as will be understood from the above description. However, there is certainly a limit to the fail-safe performance of such a system, and it cannot be positively confirmed that the ATC apparatus is fail-safe under all conditions. This is because, in the realization of the fail-safe performance of the ATC apparatus, the failure mode of its parts is previously assumed, and also, the number of simultaneous occurrence of failures is assumed to be only one. In the case of a digital IC, for example, only a degeneration failure in which its input and output terminals are maintained fixed at the level of "0" or "1" is assumed, and no consideration is given to the uncertain failure in which the level of the output from the IC changes accidentally to "0" to "1", and no consideration is also given to a failure in which occurrence of an accident in the IC package results in a change in the designed function of the IC. Further, failures of plural parts due to, for example, an external surge voltage are not taken into consideration, and a short-circuit between conductors due to intrusion of foreign matter therebetween also is not taken into consideration. Generally, such a failure cannot occur or hardly occurs. On the other hand, however, it is well known that a vital accident typically occurs when a situation considered to rarely happen has occurred or when one problem has accidentally overlapped another problem.
As described already, it is the function of the signal receiving section of the ATC apparatus to discriminate the frequency of the received ATC signal, and, because of the fact that the ATC signal has a predetermined frequency, this function can be achieved by comparing the frequency of the ATC signal with those of a plurality of reference frequency signals. On the other hand, the frequency comparison itself is the sole function of the speed correlating section of the ATC apparatus. In spite of the fact that the signal receiving section and speed correlating section of the ATC apparatus are thus similar in their functions, these sections have been furnished as independent units in which not only the hardware parts but also the parts including the power sources and casings are separately provided. The resultant increase in the number of parts, volume, weight, power consumption, etc. of the prior art ATC apparatus has resulted in degradation of the reliability which is most important for this kind of apparatus.